noun: fix validation, refcounts, and results in lagoon jets

[sigilante]

Prompted by ~dozreg-toplud's refcount linter, which flagged leaked nouns in the lagoon jets' _check, plus a hand audit of the surrounding code against the Hoon library the jets serve. The audit turned up considerably more than the linter findings: broken validation, jet/Nock semantic divergences, wrong-result kernel bugs, and a family of leaks. Everything lands in pkg/noun/jets/i/lagoon.c.

_check helper

The old _check was wrong in four independent ways:

• u3qa_dec's result was never freed (the linter's finding), and u3r_met's raw c3_w return was type-punned through u3_atom.
• The shape product was computed in c3_d, truncated into a u3_atom, and compared word-for-word against a noun — so any well-typed ray with ≥ 2³¹ elements spuriously failed _check (jet crashes where the Nock succeeds), and a crafted shape whose product wraps could pass it.
• The product could silently overflow 64 bits.
• The bloq went into u3r_met unvalidated; u3r_met requires a_y < 37 and only enforces it with c3_dessert, which release builds compile out — undefined behavior on a hostile bloq.

The rewrite takes meta/data as two borrowed nouns (no cell is consed, nothing is allocated), computes the product with overflow detection (an overflowed product cannot equal the block count of any real atom, which mirrors the Hoon), handles bloqs ≥ 37 the way +met does, and bails %exit only where +check itself crashes (cell dims, improper shape list, zero data underflowing +dec).

Every call site previously passed _check(u3nc(x_meta, x_data)). u3nc transfers ownership, but the metas/datas are borrowed from the sample, and the cell was never freed — one leaked cell per jet invocation, with the ownership violation masked by the leak (naively freeing the cell would have corrupted the sample's refcounts).

Wrapper ↔ Hoon divergences

• transpose/diag passed the whole core to _check (_check(cor)), which then read the gate's battery as ray metadata — these two jets unconditionally bailed %exit whenever they fired. This had gone unnoticed because there are no transpose tests in the desks that exercise the jets.
• The elementwise (+add/+sub/+mul/+div/+mod), comparison (+gth/+gte/+lth/+lte), scalar (+add-scalar &c), +abs, and +trace wrappers never called _check at all, though the Hoon asserts it — the jet computed a result where the Nock deterministically crashes.
• +ravel has no +check and never reads the kind, so its wrapper now punts (not bails) on an inconsistent ray.
• +dot only asserts equal shapes outside the %i754 path; the full meta-equality and consistency assertions moved inside the %i754 case so other kinds punt to the Nock instead of bailing.
• +mmul never compared the two rays' bloq/kind (the Hoon computes elementwise on each ray's own meta; the kernel assumes one width), and its gemm switch had no default — an out-of-range bloq silently returned a zero matrix. Both cases now punt.
• Reduction results (+cumsum/+min/+max/+dot) hard-coded shapes ~[1], ~[1 1], or ~[n 1]; +scalar-to-ray actually returns an all-ones shape of the input's rank. The dot wrapper's ~[n 1] produced a shape/data-inconsistent ray outright.
• _set_rounding now reports an unrecognized rounding mode so callers punt, instead of u3m_bail(c3__fail).

Kernel bugs (wrong results)

All previously unobservable because the wrapper bailed before reaching them, or untested:

• trace computed (dot d d) — the sum of squares of the diagonal — instead of (cumsum (diag a)). Identity-matrix tests mask this (1² = 1).
• transpose read and wrote with rows/columns swapped (correct only for square matrices), and the wrapper returned the unswapped shape.
• argmin/argmax returned len - i - 1 instead of the ravel index i.
• diag and abs return elements in natural order, in lockstep with lagoon: fix element order in +diag/+abs, result shape in bloq-4 +range urbit#7388, which removes erroneous flops in +diag and +el-wise-op (the "compensate for LSB" comment there is mistaken — +rep puts the first list element lowest, so the flop reverses the elements). Skew note: the old abs jet already returned natural order, so jetted and unjetted ships disagree about +abs today — the Hoon fix converges with deployed jet behavior; the old diag jet never returned at all. The two PRs should land together.
• trace honors the door rounding mode (its sum previously used whatever softfloat_roundingMode was left over); linspace fences an indirect count atom before using it as a raw integer in allocation sizes.
• mod (ray-ray and scalar) rounded the quotient with a hardcoded round-toward-zero, but +toi rounds in the door mode — 7 mod 2 is -1 under %n, not 1. It also returned values where the Hoon crashes: a non-finite quotient (zero or NaN divisor) is (need ~). And mod-scalar/div-scalar multiplied by a rounded 1/n instead of dividing — wrong even for exact quotients (21 mod 7 gave 7; 21/7 gave 2.9999998). All four kernels now divide directly, round via softfloat_roundingMode, and bail %exit on a non-finite quotient.
• gth/gte used SoftBLAS's f_gt/f_ge macros, which are (!le)/(!lt) — true whenever either operand is NaN, where IEEE gt/ge are false. The same disease reaches min/max/argmax through f_min/f_max. All now use lt/le with swapped operands, which also reproduces the Hoon reel-fold exactly (NaN at the head is sticky, interior NaN is skipped, first-of-ties wins).
• range counted elements with a one-shot ceil((b-a)/d), but the Hoon iterates x+d in the door mode testing each sum against b — for d = .0.1 the two shapes disagreed outright (10 vs 11 elements). The kernel now replicates the iteration (the values are the accumulated sums), the wrapper takes the count from the result's block count, and it punts on non-finite bounds/step, a zero step, or a stalled accumulator (x+d == x short of b), where the Nock loops forever.

Also fixed leaks of _get_dims arrays in the diag/dot wrappers and trace kernel (with raw c3_d dimensions used directly as nouns — invalid for dims ≥ 2³¹), the argmin/argmax scan buffers, and over-kept result shape cells in linspace/range.

Verification

Fresh fake ship (-F bus, urbit-408k pill) on this branch, against the base lib/lagoon.hoon with the urbit/urbit#7388 flop fixes applied (its %add-rays &c hints match the tree registration), differentially compared with a de-jetted copy of the same library (parent ~% %non hint renamed so nothing registers):

• 36/36 elementwise-equality checks pass, including: transpose/mmul of non-square matrices, diag/trace, reduction shapes at rank 1, argmin/argmax with extrema away from index 0 and with NaN at and after the head, mod under %n/%u, mod-scalar and div-scalar on exact quotients, gth/gte/lth against NaN, abs on negative entries, ravel, linspace, range with d = .0.1 and with a negative step, and add/cumsum/mod-scalar/range under non-default rounding modes via +lake.
• Zero-divisor mod crashes on both doors (jet bails %exit where the Nock's (need ~) crashes).
• Jets confirmed firing, not punting: 40×40 %i754 mmul+trace runs in ≤3 s jetted vs ~25 s interpreted, with bit-identical results.

Notes for reviewers: u3r_met returns c3_w, so +check on atoms of ≥ 2³² blocks is still constrained upstream of this file; and the SoftBLAS gemm reads B with ldc instead of ldb (harmless here since the jet passes ldb == ldc, but worth fixing in SoftBLAS). SoftBLAS's f_gt/f_ge/f_min/f_max macros are NaN-incorrect for the same !le reason and deserve an upstream fix there too; this PR routes around them locally.

🤖 Generated with Claude Code